added a check_password endpoint